Description
A security vulnerability has been detected in Toggl OÜ Toggl Track Extension up to 4.11.21. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.22 mitigates this issue. Upgrading the affected component is advised. The vendor confirms, that "[i]t was fixed in 4.11.21 on Chrome and 4.11.22 on Firefox."
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Toggl OÜ | Toggl Track Extension | 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.11.7, 4.11.8, 4.11.9, 4.11.10, 4.11.11, 4.11.12, 4.11.13, 4.11.14, 4.11.15, 4.11.16, 4.11.17, 4.11.18, 4.11.19, 4.11.20, 4.11.21 | 4.11.22 |
References
- VDB-397230 | Toggl OÜ Toggl Track Extension postMessage origin validation vdb-entry
- VDB-397230 | CTI Indicators (IOB, IOC) signature permissions-required
- CVE-2026-82811 | CVE Analysis and Report third-party-advisory
- Submit #875273 | Toggl OÜ Toggl Track 4.11.16 Origin Validation Error third-party-advisory
- https://github.com/xryj920/chrome_extensions/blob/main/Toggl%20O%C3%9C%20Toggl%20Track%204.11.16%20accepts%20forged%20session-state%20messages%20through%20an%20unauthenticated%20postMessage%20handler exploit